Integrating PingOne with AWS IAM account access manager

PingOne can authenticate users and provision users, groups, and group membership to AWS IAM Identity Center. AWS IAM account access manager (AAM) then assigns those IAM Identity Center users and groups to existing IAM roles in AWS accounts.

What is AWS IAM account access manager?

AWS IAM account access manager lets organizations assign AWS account access to users and groups in their IAM Identity Center organization by using existing IAM roles. Organizations can synchronize identities into IAM Identity Center from an existing directory or manage them directly in IAM Identity Center.

Organizations can keep existing IAM Identity Center permission set assignments for standardized access and use AAM for access that requires custom IAM roles. The two models can operate together when an organization needs both.

AAM stores the account-and-role mapping, while the IAM role remains an AWS resource managed by the customer. Existing roles can use custom trust policies, role tags for attribute-based access control, and role paths. After signing in through PingOne, users select an assigned AWS account and role in the AWS account access portal.

Use PingOne for identity and AWS IAM Roles for account access

The services have distinct responsibilities:

PingOne authenticates users and manages identity lifecycle
        ↓
IAM Identity Center receives users, groups, and memberships
        ↓
Account access manager maps identities to AWS accounts and roles
        ↓
IAM roles define permissions
        ↓
AWS account access portal lists assigned accounts and roles

This model lets organizations keep identity management in PingOne while using customer-managed IAM roles for AWS access.

How PingOne and AWS work together

PingOne: Identity and Authentication

PingOne is the external identity source for IAM Identity Center. Administrators use it to manage users, groups, authentication policies, and lifecycle events.

PingOne acts as the SAML identity provider for IAM Identity Center and can provision users, groups, and group membership through SCIM.

For configuration details, see PingOne - Creating a SCIM connection.

IAM Identity Center: Identities used by AWS

IAM Identity Center stores the synchronized users, groups, and memberships from PingOne. AWS uses these identities for sign-in, and AAM uses them when evaluating access assignments.

Account access manager: Account and role assignment

AAM maps an IAM Identity Center user or group to an existing IAM role in a target AWS account. The mapping determines which identity can access which account and role.

AWS IAM: Permissions

The IAM role defines what the user can do after access is granted. AAM controls which identity can access an account and role; IAM controls the permissions in that role.

Where this integration fits

Custom roles across AWS accounts

Teams can create roles for engineering, operations, security, finance, or support and assign them to users and groups provisioned from PingOne through AAM.

A platform engineering group might receive a production read-only role, a staging deployment role, and a development role. Each role can be defined in the account where it is used.

Least-privilege access

AAM does not require every user to receive administrator or broad read-only access. Teams can create roles for a specific task, account, environment, or service.

For example, an application support role might allow users to inspect logs and metrics without changing production resources. A security investigation role might provide access to security services and configuration history without granting administrative permissions.

Temporary or delegated access

Support and operations teams may need access during an incident or for a defined maintenance task. AAM can assign a dedicated role to an individual user or group. When the work is complete, remove the AAM assignment or remove the user from the PingOne group and allow the membership change to synchronize.

AAM also supports delegation: workload teams can define roles in their AWS accounts, while central identity or security teams manage which IAM Identity Center users and groups receive access.

Getting started

Use these steps to test the integration before a wider rollout. Start with a dedicated test user, a target account, and a role with limited permissions.

1. Verify the AWS foundation

Confirm that:

• IAM Identity Center is enabled as an organization instance.
• PingOne is configured as the external identity source.
• SAML sign-in from PingOne to IAM Identity Center is working.
• SCIM provisioning is enabled for users, groups, and group membership in the PingOne connection.
• The target AWS account is in the organization scope used by AAM.
• An administrator can manage IAM roles, IAM Identity Center, and AAM.

2. Create or select a PingOne test user and group

In the PingOne admin console:

1. Create or select a dedicated test user, such as AWS_AAM_Test_User@example.com.
2. Create or select a test group, such as AAMLabReadOnly.
3. Add the test user to the group.
4. Confirm that the PingOne connection is configured to provision groups and group membership to IAM Identity Center.

Use the PingOne Directory documentation for the current user and group management workflow.

3. Verify the identities in IAM Identity Center

1. Open IAM Identity Center.
2. Open Users and confirm that the test user is present.
3. Open Groups and confirm that the test group is present.
4. Confirm that the test user is a member of the synchronized group.
5. Confirm that the user attributes required for sign-in are populated.

4. Create the IAM role

In the target AWS account:

1. Open IAM > Roles.
2. Create a role named AAMLabReadOnly, or use an approved role name.
3. Configure the trust relationship required by account access manager, following the AWS account access manager documentation.
4. Attach a suitable permissions policy. For a lab, use ReadOnlyAccess; for production, use a policy designed for the specific workload.

AAM assigns access to an existing role; it does not replace the role’s trust relationship or permissions policy. Review both before creating the AAM assignment.

5. Create the AAM assignment

In the AWS console:

1. Open IAM > Account access manager.
2. Confirm that AAM is associated with the organization’s IAM Identity Center instance.
3. Open Accounts and select the target AWS account.
4. Choose Assign new access.
5. Select the synchronized IAM Identity Center group.
6. Enter or select the existing IAM role name.
7. Review the account, group, and role mapping.
8. Submit the assignment.
9. Wait for the assignment to become active.

The assignment has this form:

IAM Identity Center group → AWS account → existing IAM role

Seeing the role in the account access portal shows that the assignment is available. A successful console session still depends on the IAM role’s trust relationship and required AWS STS permissions.

6. Validate access and lifecycle changes

Use a fresh browser session for each test:

• Access: Sign in through PingOne, open the AWS account access portal, select the target account, and choose the assigned role.
• Permissions: Confirm that an allowed read operation succeeds and that an administrative operation is denied.
• Revocation: Remove the user from the assigned PingOne group, allow the membership change to synchronize, and confirm that the role is no longer available.
• Restoration: Add the user back to the PingOne group, allow the change to synchronize, and confirm that the role becomes available again.
• Direct assignment: If the assignment targets an individual user instead of a group, remove or restore the AAM assignment and repeat the access test.

If the role appears in the portal but sign-in fails, review the IAM role’s trust relationship and required AWS STS permissions.

Operating model

Define ownership before rollout:

Responsibility	Typical owner
PingOne users, groups, memberships, and authentication policies	PingOne administrators
IAM Identity Center identity source and organization configuration	AWS platform or cloud identity team
IAM role design, trust relationships, and permissions	AWS platform, security, or workload owners
AAM account-to-role assignments	Cloud governance or delegated AAM administrators
Access reviews and lifecycle validation	Security and application owners

Use descriptive names for groups, roles, and account mappings. A reviewer should be able to identify the user or group, target account, and assigned role from an AAM assignment.

Next steps

Start with one PingOne test user, one synchronized group, one least-privilege IAM role, and one target AWS account. Confirm successful sign-in, allowed and denied actions, revocation, restoration, and role assumption before expanding to additional accounts and workloads.

Join the discussion on the Ping Identity developer community.